The method is called vulnerability scanning, and the tools are vulnerability scanners. They are the measuring instrument of vulnerability management: without regular scans, a company does not know where outdated software or insecure settings are running. In its guide SP 800-115, the US institute NIST describes the scan as a technique used to identify hosts, their attributes and the associated vulnerabilities.
How does a vulnerability scan work?
- Define targets: Which network ranges, servers, clients or web applications will be checked, and who approved this?
- Discover: The scanner finds active systems and open services and determines operating systems and software versions.
- Match: The versions and settings found are compared with a database of known vulnerabilities, usually with a CVE identifier and a CVSS rating. The signatures must be up to date before each run.
- Assess: Experts review the findings, weed out false positives and rank them by risk.
- Verify: After remediation, a new scan confirms that the vulnerability has been closed.
What types are there?
- External and internal: An external scan shows what is visible from the internet. An internal scan usually finds significantly more. NIST recommends both perspectives.
- Authenticated and unauthenticated: Scans with administrator credentials see installed software and settings in detail. Scans without credentials only see what a service reveals to the outside.
- Network, agent and web application scans: Agents on the devices continuously supply data, including from laptops outside the corporate network. Web application scanners specifically look for flaws such as injection or missing access checks.
Vulnerability scan or penetration test?
A scan works broadly and automatically, a penetration test deeply and manually. The BSI describes the non-invasive vulnerability scan as a check that does not exploit vulnerabilities and therefore produces more false positives, because scanners judge by version levels. A scanner does not detect combinations of several vulnerabilities. NIST therefore recommends regular scans, supplemented by penetration tests at longer intervals. In the BSI's IT-Grundschutz, automated tests for vulnerabilities are a requirement for increased protection needs.
In practice for SMEs and municipalities
- Start with a complete inventory, see IT asset management. Systems that are not known are not scanned either.
- Scan regularly and after major changes, and systems reachable from the outside particularly often.
- Check old devices, machine controls and building technology carefully, as aggressive scans can disrupt them.
- Only scan systems for which you have permission, including cloud services and hosting providers.
- The free website security check provides a first look at your own website from the outside. It checks publicly visible characteristics and does not replace a vulnerability scan.
How TOMORIS relates
GRID.scout examines the agreed environment regularly, assesses findings with reachability, impact and context, and tracks the measures until remediation. GRID.patch plans the updates themselves.